CVE-2024-10519: Wishlist for WooCommerce XSS Vulnerability

CVE-2024-10519 Overview

CVE-2024-10519 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress. The flaw affects versions 3.0.8 through 3.1.2 and stems from insufficient input sanitization and output escaping on the wtab parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the user clicks a crafted link. The issue only impacts WordPress installations running PHP 7.4 or earlier. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, or redirection to attacker-controlled resources on WooCommerce storefronts running vulnerable PHP versions.

Affected Products

WPFactory Wishlist for WooCommerce: Multi Wishlists Per Customer PRO versions 3.0.8 through 3.1.2
WordPress installations running PHP version 7.4 or earlier
WooCommerce storefronts that expose the wishlist template to unauthenticated visitors

Discovery Timeline

2024-11-23 - CVE-2024-10519 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10519

Vulnerability Analysis

The vulnerability resides in the plugin's wish-list template file, specifically in the handling of the wtab request parameter. The template reflects the parameter value directly into the rendered HTML without proper sanitization or output escaping. This allows an attacker to append JavaScript payloads that execute in the context of the victim's browser session on the target site.

Because the scope change component of the vulnerability crosses trust boundaries, injected scripts can access data beyond the vulnerable component. An attacker requires no authentication and only needs the victim to click a malicious link pointing to the wishlist page with a crafted wtab value. The affected code path can be reviewed in the plugin's templates/wish-list.php file.

Root Cause

The root cause is missing input sanitization and missing output escaping on user-controlled data. The plugin retrieves the wtab parameter and echoes it into the wish-list template without applying WordPress escaping functions such as esc_attr() or esc_html(). The PHP 7.4 conditional suggests that later PHP versions apply stricter type coercion or default filtering that neutralizes the payload, while older interpreters render the raw string.

Attack Vector

Exploitation follows a standard reflected XSS pattern. The attacker crafts a URL to the vulnerable WooCommerce store containing a malicious payload in the wtab query parameter. The attacker distributes the link via phishing email, social media, or malicious advertising. When a victim visits the link, the server reflects the payload into the wishlist page HTML, and the browser executes the injected script under the site's origin.

The vulnerability requires no privileges but does require user interaction to trigger. Consult the Wordfence Vulnerability Report and the WordPress Trac Wish List Code for the affected sink location.

Detection Methods for CVE-2024-10519

Indicators of Compromise

HTTP GET requests to wishlist endpoints containing wtab= values with URL-encoded <script>, onerror=, onload=, or javascript: tokens
Referrer headers pointing to unfamiliar external domains preceding wishlist page requests
Unexpected outbound requests from browser sessions to attacker-controlled domains following wishlist page views
Web server access logs showing malformed or oversized wtab parameter values

Detection Strategies

Deploy web application firewall rules that inspect the wtab query parameter for HTML tags and JavaScript event handlers
Enable content security policy (CSP) reporting to capture blocked inline script executions on wishlist pages
Correlate WordPress access logs with plugin version data to identify vulnerable installations receiving suspicious traffic
Baseline normal wtab parameter values, which should be short alphanumeric strings, and alert on deviations

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized log platform for query-based hunting on the wtab parameter
Monitor for authenticated administrator sessions originating from IP addresses that recently accessed suspicious wishlist URLs
Track outbound DNS and HTTP traffic from customer browsers to detect data exfiltration attempts sourced from injected scripts

How to Mitigate CVE-2024-10519

Immediate Actions Required

Update the Wishlist for WooCommerce PRO plugin to a version newer than 3.1.2 that includes the fix from changeset 3189775
Upgrade PHP to version 8.0 or later, which is not affected by this vulnerability
Review web server access logs for prior exploitation attempts targeting the wtab parameter
Reset credentials for any administrator accounts that may have accessed wishlist pages via untrusted links

Patch Information

The vendor addressed the issue in changeset 3189775 on the WordPress plugin repository. Administrators should apply the update through the WordPress plugin manager or by pulling the latest release from the WordPress Plugin Developer Info page. Verify the installed version after updating.

Workarounds

Upgrade the site's PHP runtime to version 8.0 or higher, which mitigates the vulnerability without requiring the plugin update
Deploy a web application firewall rule that strips or blocks HTML metacharacters in the wtab query parameter
Implement a strict Content Security Policy that disallows inline scripts on wishlist pages
Temporarily disable the Wishlist for WooCommerce PRO plugin if patching and PHP upgrades cannot be performed immediately

bash

# Example ModSecurity rule to block reflected XSS payloads in the wtab parameter
SecRule ARGS:wtab "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1010519,phase:2,deny,status:403,log,\
    msg:'CVE-2024-10519 Wishlist for WooCommerce XSS attempt blocked'"